Issued:
2015-04-20
Updated:
2015-04-20

RHSA-2015:0856 - Security Advisory

Synopsis

Moderate: postgresql92-postgresql security update

Type/Severity

Security Advisory: Moderate

Topic

Updated postgresql packages that fix multiple security issues are now
available for Red Hat Satellite 5.7.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

PostgreSQL is an advanced object-relational database management system
(DBMS).

An information leak flaw was found in the way the PostgreSQL database
server handled certain error messages. An authenticated database user could
possibly obtain the results of a query they did not have privileges to
execute by observing the constraint violation error messages produced when
the query was executed. (CVE-2014-8161)

A buffer overflow flaw was found in the way PostgreSQL handled certain
numeric formatting. An authenticated database user could use a specially
crafted timestamp formatting template to cause PostgreSQL to crash or,
under certain conditions, execute arbitrary code with the permissions of
the user running PostgreSQL. (CVE-2015-0241)

A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto module.
An authenticated database user could use this flaw to cause PostgreSQL to
crash or, potentially, execute arbitrary code with the permissions of the
user running PostgreSQL. (CVE-2015-0243)

A flaw was found in the way PostgreSQL handled certain errors that were
generated during protocol synchronization. An authenticated database user
could use this flaw to inject queries into an existing connection.
(CVE-2015-0244)

Red Hat would like to thank the PostgreSQL project for reporting these
issues. Upstream acknowledges Stephen Frost as the original reporter of
CVE-2014-8161; Andres Freund, Peter Geoghegan, Bernd Helmle, and Noah Misch
as the original reporters of CVE-2015-0241; Marko Tiikkaja as the original
reporter of CVE-2015-0243; and Emil Lenngren as the original reporter of
CVE-2015-0244.

All PostgreSQL users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. If the postgresql
service is running, it will be automatically restarted after installing
this update.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Satellite 5.7 x86_64
  • Red Hat Satellite 5.7 s390x
  • Red Hat Satellite 5 Managed DB 5.7 x86_64
  • Red Hat Satellite 5 Managed DB 5.7 s390x

Fixes

  • BZ - 1182043 - CVE-2014-8161 postgresql: information leak through constraint violation errors
  • BZ - 1188684 - CVE-2015-0241 postgresql: buffer overflow in the to_char() function
  • BZ - 1188689 - CVE-2015-0243 postgresql: buffer overflow flaws in contrib/pgcrypto
  • BZ - 1188694 - CVE-2015-0244 postgresql: loss of frontend/backend protocol synchronization after an error

CVEs

References

Red Hat Satellite 5.7

SRPM
postgresql92-postgresql-9.2.10-2.el6.src.rpm SHA-256: 6ef205aee9bd5d06e3f9e83b5116f6f4f1b4f3afc5b528de70efcbe71c75dc02
x86_64
postgresql92-postgresql-9.2.10-2.el6.x86_64.rpm SHA-256: 96113cb23ec05c48516f28f8e52a319ad5f136605cb82fe3212757f4d3dd13e7
postgresql92-postgresql-contrib-9.2.10-2.el6.x86_64.rpm SHA-256: e2cf3eb3c8547a01440fb7f12a7467180c5befda8231234e6be6441da17fc905
postgresql92-postgresql-libs-9.2.10-2.el6.x86_64.rpm SHA-256: 8569bd0768b4d124b4cb1c12cbe375954ca72e2a24a8f52d417f23466d1a2846
postgresql92-postgresql-pltcl-9.2.10-2.el6.x86_64.rpm SHA-256: e9db27a0d9165e83bef5e473c39db07fcf22df9763ecaaab78782760b69d0709
postgresql92-postgresql-server-9.2.10-2.el6.x86_64.rpm SHA-256: 9384bb742e32818ebd39c6fd6b01a3fa6f946fc775fff1ffb820787acf10d5a4
postgresql92-postgresql-upgrade-9.2.10-2.el6.x86_64.rpm SHA-256: 0a49974b0e9f2cc66f0d53973b849e54b9fbdaa4608fa0da3b6d70076726177f
s390x
postgresql92-postgresql-9.2.10-2.el6.s390x.rpm SHA-256: fdb1b0736648b5903e9178bdbab206145538fbbc5ccd6d2aff8532284e9a07da
postgresql92-postgresql-contrib-9.2.10-2.el6.s390x.rpm SHA-256: a95e23c553fad3afd038a0fbfa2339c0ab18a27413a688c087e79a7927856450
postgresql92-postgresql-libs-9.2.10-2.el6.s390x.rpm SHA-256: 3326804f23702e1f171c8534afd9c5e31cd13a6799b62f8132761dd78d81dedc
postgresql92-postgresql-pltcl-9.2.10-2.el6.s390x.rpm SHA-256: 37cef9da7d7d5513c7b6dbce7d8f9f6a328c28556520446aaabe04e30f2598b5
postgresql92-postgresql-server-9.2.10-2.el6.s390x.rpm SHA-256: 5cd4747da36a52828eabf7577e50c912c57ead16d1fdd9f575f8b8c3d8b4074c
postgresql92-postgresql-upgrade-9.2.10-2.el6.s390x.rpm SHA-256: c127b4328987c8e50aa32b63f54ce50b9dcc81bf55cd688a3e2e12c3d1ebaa5b

Red Hat Satellite 5 Managed DB 5.7

SRPM
postgresql92-postgresql-9.2.10-2.el6.src.rpm SHA-256: 6ef205aee9bd5d06e3f9e83b5116f6f4f1b4f3afc5b528de70efcbe71c75dc02
x86_64
postgresql92-postgresql-9.2.10-2.el6.x86_64.rpm SHA-256: 96113cb23ec05c48516f28f8e52a319ad5f136605cb82fe3212757f4d3dd13e7
postgresql92-postgresql-contrib-9.2.10-2.el6.x86_64.rpm SHA-256: e2cf3eb3c8547a01440fb7f12a7467180c5befda8231234e6be6441da17fc905
postgresql92-postgresql-libs-9.2.10-2.el6.x86_64.rpm SHA-256: 8569bd0768b4d124b4cb1c12cbe375954ca72e2a24a8f52d417f23466d1a2846
postgresql92-postgresql-pltcl-9.2.10-2.el6.x86_64.rpm SHA-256: e9db27a0d9165e83bef5e473c39db07fcf22df9763ecaaab78782760b69d0709
postgresql92-postgresql-server-9.2.10-2.el6.x86_64.rpm SHA-256: 9384bb742e32818ebd39c6fd6b01a3fa6f946fc775fff1ffb820787acf10d5a4
postgresql92-postgresql-upgrade-9.2.10-2.el6.x86_64.rpm SHA-256: 0a49974b0e9f2cc66f0d53973b849e54b9fbdaa4608fa0da3b6d70076726177f
s390x
postgresql92-postgresql-9.2.10-2.el6.s390x.rpm SHA-256: fdb1b0736648b5903e9178bdbab206145538fbbc5ccd6d2aff8532284e9a07da
postgresql92-postgresql-contrib-9.2.10-2.el6.s390x.rpm SHA-256: a95e23c553fad3afd038a0fbfa2339c0ab18a27413a688c087e79a7927856450
postgresql92-postgresql-libs-9.2.10-2.el6.s390x.rpm SHA-256: 3326804f23702e1f171c8534afd9c5e31cd13a6799b62f8132761dd78d81dedc
postgresql92-postgresql-pltcl-9.2.10-2.el6.s390x.rpm SHA-256: 37cef9da7d7d5513c7b6dbce7d8f9f6a328c28556520446aaabe04e30f2598b5
postgresql92-postgresql-server-9.2.10-2.el6.s390x.rpm SHA-256: 5cd4747da36a52828eabf7577e50c912c57ead16d1fdd9f575f8b8c3d8b4074c
postgresql92-postgresql-upgrade-9.2.10-2.el6.s390x.rpm SHA-256: c127b4328987c8e50aa32b63f54ce50b9dcc81bf55cd688a3e2e12c3d1ebaa5b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.